docs(automation): say an http node's url and headers are served; route credentials to connector credentialRef (#20663)

Fixes #20655
Clause-②: no

Docs half of #20590 (guidance faces only, nothing withheld, no code
touched). Two pages, three edits.

## What changed
- `content/docs/automation/flows.mdx`, HTTP Request example: the
secret-bearing incoming-webhook url is replaced by a neutral
`https://api.example.com/v1/order-events`, and a warning callout follows
it.
- `content/docs/automation/connectors.mdx`, `rest` provider: one
paragraph pointing `headers` / `defaultHeaders` to `auth.credentialRef`.

## The sentence (for #20654 to copy)
No open PR links #20654 and it has no PR yet, so this page writes the
sentence first. #20654 must copy it verbatim into the spec describe
text:

> A flow definition, including an `http` node's `url` and `headers`, is
served to every member who can read flows.

The callout continues: a token, API key or signed webhook url written
there is readable by all of them; route an outbound credential to a
declarative connector's `auth.credentialRef` and call it with a
`connector_action` node.

## Claims verified against origin/main f4ce10c
- Served: `GET /:name` answers `servedFlowDefinition(flow)`
(`packages/runtime/src/domains/automation.ts:3028-3034`); the redactor
is
`packages/services/service-automation/src/flow-credential-projection.ts`,
table `FLOW_NODE_CREDENTIAL_KEYS` (`start` -> `secret`, `http` ->
`signingSecret`). Only those two keys are dropped, so `url` and
`headers` are served as written. The callout says so, so it does not
overclaim.
- Consumed: the `http` node reads `cfg.url` and `cfg.headers` verbatim
(`packages/services/service-automation/src/builtin/http-nodes.ts:125-129`),
sends `headers` on the request (`:255-261`).
- `credentialRef`: `auth` on a provider-bound instance
(`packages/spec/src/integration/connector.zod.ts:1005`),
`ConnectorInstanceAuthSchema` variants bearer / api-key / basic each
with `credentialRef: z.string().min(1)`
(`packages/spec/src/shared/connector-auth.zod.ts:123-152`); the rest
provider receives the resolved auth
(`packages/connectors/connector-rest/src/rest-provider.ts:53`).

## Acceptance notes
- Flows have no per-type read permission on this path (the per-caller
read gate in `packages/rest/src/meta-item-read-gate.ts` covers docs,
apps and books); the docs therefore say "every member who can read
flows", the triage direction's wording, and do not name a permission.
- `flows.mdx` still lists "an `http` node posting to an incoming
webhook" as the Slack replacement in the retired-shapes table. Left
untouched (out of this card's three edits).

## Gates
`node scripts/pm/dispatch-gates.mjs --commands`: 40 derived, 40 run,
reconciled with `--ran` at head 2c78a7a. All exit 0, except `pnpm
--filter @objectstack/spec run check:skill-examples`, exit 3
PREREQUISITE NOT MET (`packages/client-react/dist` not built): NOT
MEASURED, and it reads skills, not these pages.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

content/docs/automation/connectors.mdx

@@ -114,6 +114,8 @@ Materializes a single **`request`** action accepting
 payload per call. Use it when the upstream is "just HTTP" and you don't have a
 spec document.
 
+Do not put a credential in `headers` or `defaultHeaders`: both are stored in metadata and served with it. Declare it as `auth.credentialRef` instead — the resolved `auth` is applied to every request — as the `Authorization` header, or for `api-key` as `headerName` (default `X-API-Key`) or the `paramName` query parameter.
+
 ### `provider: 'openapi'` — one action per operation
 
 Config: **`spec`** (required) and **`baseUrl`** (optional — overrides the

content/docs/automation/flows.mdx

@@ -261,15 +261,19 @@ nothing is assigned or written in its place.
 {
   id: 'notify_slack',
   type: 'http',
-  label: 'Send Slack Notification',
+  label: 'Post Order Event',
   config: {
-    url: 'https://hooks.slack.com/services/...',
+    url: 'https://api.example.com/v1/order-events',
     method: 'POST',
-    body: { text: 'New order: {record.name}' },
+    body: { event: 'order.created', name: '{record.name}' },
   },
 }
 ```
 
+<Callout type="warn" title="Do not put a secret in an http node's url or headers">
+A flow definition, including an `http` node's `url` and `headers`, is served to every member who can read flows. A token, API key or signed webhook url written there is readable by all of them. Route an outbound credential to a declarative connector's `auth.credentialRef` and call it with a `connector_action` node instead — see [Connectors](/docs/automation/connectors#authentication). Only `signingSecret` (and a start node's `secret`) is withheld when a definition is served; `url` and `headers` are served as written.
+</Callout>
+
 **Script:**
 
 The built-in `script` executor never evaluates an arbitrary JavaScript string —